News Mania Desk/ Agnibeena Ghosh/18th June 2024
Microsoft has unveiled a bold initiative to link the annual bonuses of its top executives to their performance in cybersecurity measures, a move aimed at bolstering its defenses amidst growing scrutiny over recent security lapses.
Brad Smith, Microsoft’s vice chair and president, disclosed this strategic shift ahead of a scheduled US House committee hearing on the tech giant’s security practices. In an addendum to his written testimony, Smith outlined that a significant portion of the annual bonuses for senior executives will now hinge on their effectiveness in managing cybersecurity risks.
For the fiscal year 2025 commencing on July 1, Microsoft’s compensation committee will evaluate a third of each executive’s “individual performance” based on their cybersecurity achievements. This assessment will not only be conducted internally but will also incorporate insights from an independent third party, whose identity remains undisclosed.
Moreover, Smith highlighted immediate changes to the current fiscal year’s bonus structure, which concludes on June 30. The compensation committee will retroactively consider each Senior Leadership Team (SLT) member’s cybersecurity performance in its annual performance evaluations. Smith emphasized that the company’s board retains discretion to adjust compensation outcomes as necessary.
Microsoft’s proactive stance on executive bonuses comes in the wake of severe criticism following cybersecurity incidents, notably the 2023 breaches affecting Microsoft Exchange Online. These breaches, attributed to a group associated with the People’s Republic of China, compromised the mailboxes of numerous organizations, including sensitive US government officials.
A subsequent review by the Department of Homeland Security (DHS) and the Cyber Safety Review Board (CSRB) underscored preventable lapses in Microsoft’s security protocols. The report identified systemic failures in key rotation practices and critical security controls, which, if implemented, could have mitigated the scale of the intrusion.
The CSRB’s Acting Deputy Chair, Dmitri Alperovitch, condemned Microsoft’s lapse, stressing the urgency for cloud service providers to adopt robust security measures against persistent threats from state-sponsored actors.
In response to these findings, Microsoft acknowledges the need for enhanced accountability and rigorous risk management across its operations. The company’s decision to tie executive bonuses directly to cybersecurity performance signals a commitment to prioritizing enterprise security and rebuilding customer trust.
Despite these proactive measures, Microsoft faces ongoing challenges in restoring its reputation as a leader in technology security. The company’s initiatives to strengthen cybersecurity protocols are seen as crucial steps towards fortifying its position amidst escalating cyber threats and maintaining its pivotal role in the technology ecosystem.
Looking ahead, Microsoft’s executives will be under heightened scrutiny not only to meet financial targets but also to uphold stringent cybersecurity standards. The effectiveness of these measures will likely play a decisive role in shaping Microsoft’s future resilience against cyber threats and its standing in the global technology landscape.
